Here in France it was just a qr code in an app, you don't get a picture of the person when you scan it, so basically sharing a screenshot of the qr code would have been enough to fool most restaurants, bars and such, because nobody bothered to ask for ID.

The vax passport is just a small yellow booklet and if you lose yours, you just get a new one from the doctor. You just sign your name and that's it. It would be pretty trivial to swap pages or maybe just write a different name on the cover.